client install: finalize API after CA certs are available

This is required for the finalize call to be able connect to the server to
retrieve API schema.

https://fedorahosted.org/freeipa/ticket/4739

Reviewed-By: David Kupka <dkupka@redhat.com>

client/ipa-client-install

@@ -2734,7 +2734,6 @@ def install(options, env, fstore, statestore):
                       debug=options.debug,
                       delegate=False,
                       nss_dir=tmp_db.secdir)
-        api.finalize()
         if 'config_loaded' not in api.env:
             root_logger.error("Failed to initialize IPA API.")
             return CLIENT_INSTALL_ERROR
@@ -2795,6 +2794,8 @@ def install(options, env, fstore, statestore):
             root_logger.info("Failed to add CA to temporary NSS database.")
             return CLIENT_INSTALL_ERROR
 
+        api.finalize()
+
         # Now, let's try to connect to the server's RPC interface
         connected = False
         try: